@openclaw/codex 2026.9.3 → 2026.9.5

package/dist/{shared-client-CVhez2Uo.js → .setup/shared-client-BpTtuLQ5.mjs}

@@ -1,33 +1,107 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { t as codexBuildSymbol } from "./build-state-6RL6qohz.js";
-import { t as CODEX_APP_SERVER_AUTH_PROVIDER } from "./auth-profile-selection-DFu9e167.js";
-import { a as resolveCodexAppServerStartOptionsForAgent, o as resolveCodexComputerUseConfig, t as codexAppServerStartOptionsKey } from "./config-options-jnIFvwxD.js";
-import { c as resolveCodexAppServerLocalHomeDir, l as resolveCodexAppServerUserHomeDir, o as isJsonObject, s as resolveCodexAppServerHomeDir, u as withEphemeralCodexAuthStore } from "./protocol-CAAcVIKF.js";
-import { t as isCodexAppServerProxyLaunch } from "./launch-args-RXQwn8zV.js";
-import { f as isUnsupportedCodexAppServerVersionError, t as CodexAppServerClient } from "./client-BEKu4yDx.js";
-import { c as resolveMacOSDesktopCodexBundledMarketplaceCandidates, l as resolveMacOSDesktopCodexComputerUseServiceAppCandidates, n as resolveManagedCodexAppServerStartOptions, o as resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath, r as resolveManagedCodexNativeCommand, s as resolveMacOSDesktopCodexAppPathCandidates, t as isManagedCodexDesktopCommand } from "./managed-binary-DrjjRRUD.js";
-import { _ as isCodexDesktopGenerationCurrent, a as readCodexCliAuthFileApiKey, c as resolveCodexAppServerPreparedApiKeyCacheKey, d as createCodexAppServerStartupLifetime, f as getCurrentSharedClientEntry, i as fingerprintTokenAuthProfileCacheKey, l as closeRetiredSharedClientEntry, m as retireSharedCodexAppServerClientIfCurrent, n as CODEX_AUTH_JSON_FILENAME, o as readFirstNonEmptyEnv, p as getSharedCodexAppServerClientState, r as fingerprintApiKeyAuthProfileCacheKey, s as resolveCodexAppServerFallbackApiKeyCacheKey, t as CODEX_APP_SERVER_API_KEY_ENV_VARS, u as closeRetiredSharedClientEntryIfIdle, v as waitForCodexDesktopGeneration } from "./auth-cache-key-Kq6oerr6.js";
-import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-BGjHoYLr.js";
-import { n as readCodexSessionMeta } from "./session-catalog-provenance-DkJHo735.js";
-import { n as withTimeout } from "./timeout-BVw8aaM1.js";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-BWf6JLWG.js";
-import { a as resolveCodexAppServerAuthProfileStore, i as resolveCodexAppServerAuthProfileIdForAgent, r as resolveCodexAppServerAuthProfileId, t as isCodexAppServerNativeAuthProfile } from "./auth-profile-CwzO4_RG.js";
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+import { n as defineCodexBuildState, t as codexBuildSymbol } from "./build-state-Xx9ybZqa.mjs";
+import { t as CODEX_APP_SERVER_AUTH_PROVIDER } from "./auth-profile-selection-DFu9e167.mjs";
+import { _ as resolveCodexAppServerUserHomeDir, g as resolveCodexAppServerLocalHomeDir, h as resolveCodexAppServerHomeDir, m as isJsonObject, v as withEphemeralCodexAuthStore } from "./config-security-BRQ2mgW9.mjs";
+import { n as isCodexAppServerProxyLaunch } from "./launch-args-DnMak49W.mjs";
+import { f as isUnsupportedCodexAppServerVersionError, t as CodexAppServerClient } from "./client-vXs2929Q.mjs";
+import { a as resolveCodexAppServerStartOptionsForAgent, d as readCodexEffectiveConfig, o as resolveCodexComputerUseConfig, t as codexAppServerStartOptionsKey, u as CODEX_SESSION_OVERRIDABLE_LAYER_TYPES } from "./config-options-BsanJ8QG.mjs";
+import { c as resolveMacOSDesktopCodexAppPathCandidates, i as resolveManagedCodexNativeCommand, l as resolveMacOSDesktopCodexBundledMarketplaceCandidates, r as resolveManagedCodexAppServerStartOptions, s as resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath, t as isManagedCodexDesktopCommand, u as resolveMacOSDesktopCodexComputerUseServiceAppCandidates } from "./managed-binary-DP6Rib3P.mjs";
+import { _ as isCodexDesktopGenerationCurrent, a as readCodexCliAuthFileApiKey, c as resolveCodexAppServerPreparedApiKeyCacheKey, d as createCodexAppServerStartupLifetime, f as getCurrentSharedClientEntry, i as fingerprintTokenAuthProfileCacheKey, l as closeRetiredSharedClientEntry, m as retireSharedCodexAppServerClientIfCurrent, n as CODEX_AUTH_JSON_FILENAME, o as readFirstNonEmptyEnv, p as getSharedCodexAppServerClientState, r as fingerprintApiKeyAuthProfileCacheKey, s as resolveCodexAppServerFallbackApiKeyCacheKey, t as CODEX_APP_SERVER_API_KEY_ENV_VARS, u as closeRetiredSharedClientEntryIfIdle, v as waitForCodexDesktopGeneration } from "./auth-cache-key-QirmgiCo.mjs";
+import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-Cmx94Oiy.mjs";
+import { n as withTimeout } from "./timeout-DZF05XrR.mjs";
+import { c as readCodexSessionMeta, n as observeCodexCatalogClient } from "./session-catalog-events-jMcYfQyd.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-CeAhl_h4.mjs";
+import { a as resolveCodexAppServerAuthProfileStore, i as resolveCodexAppServerAuthProfileIdForAgent, r as resolveCodexAppServerAuthProfileId, t as isCodexAppServerNativeAuthProfile } from "./auth-profile-WqZtZfXN.mjs";
 import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash } from "node:crypto";
+import { isDeepStrictEqual } from "node:util";
 import { AgentHarnessPreflightError, resolveDefaultAgentDir } from "openclaw/plugin-sdk/agent-harness-registration";
 import { addTimerTimeoutGraceMs, resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
 import { runExec } from "openclaw/plugin-sdk/process-runtime";
 import fs, { constants } from "node:fs";
 import path from "node:path";
 import fs$1 from "node:fs/promises";
-import { pruneMapToMaxSize } from "openclaw/plugin-sdk/collection-runtime";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
-import { isDeepStrictEqual } from "node:util";
-import { ensureAuthProfileStore, findPersistedAuthProfileCredential, loadAuthProfileStoreForSecretsRuntime, refreshOAuthCredentialForRuntime, resolveApiKeyForProfile, resolvePersistedAuthProfileOwnerAgentDir } from "openclaw/plugin-sdk/agent-runtime";
+import { ensureAuthProfileStore, findPersistedAuthProfileCredential, refreshOAuthCredentialForRuntime, resolveApiKeyForProfile, resolvePersistedAuthProfileOwnerAgentDir } from "openclaw/plugin-sdk/agent-runtime";
 import { AgentHarnessPreflightError as AgentHarnessPreflightError$1, embeddedAgentLog as embeddedAgentLog$1, formatErrorMessage } from "openclaw/plugin-sdk/agent-harness-runtime";
-import { resolveProviderIdForAuth } from "openclaw/plugin-sdk/provider-auth-aliases";
-import { assertNoSymlinkParents } from "openclaw/plugin-sdk/security-runtime";
 import { hasUsableOAuthCredential, resolveOpenAICodexAuthIdentity } from "openclaw/plugin-sdk/provider-auth";
+import { pruneMapToMaxSize } from "openclaw/plugin-sdk/collection-runtime";
+import { assertNoSymlinkParents } from "openclaw/plugin-sdk/security-runtime";
+//#region extensions/codex/src/app-server/attempt-timeouts.ts
+/**
+* Timeout defaults and normalizers for Codex app-server startup and turn
+* liveness watches.
+*/
+/** Minimum startup timeout accepted by the Codex app-server harness. */
+const CODEX_APP_SERVER_STARTUP_TIMEOUT_FLOOR_MS = 100;
+const TURN_TERMINAL_SETTLEMENT_TIMEOUT_MS = 12e4;
+const TURN_FINALIZE_DRAIN_ABORT_GRACE_MS = 5e3;
+var CodexAppServerStartupError = class extends Error {
+	constructor(reason, message = reason === "timed_out" ? "codex app-server startup timed out" : "codex app-server startup aborted") {
+		super(message);
+		this.reason = reason;
+		this.code = "CODEX_APP_SERVER_STARTUP_CANCELLED";
+		this.name = "CodexAppServerStartupError";
+	}
+};
+function isCodexAppServerStartupError(error, reason) {
+	return error instanceof Error && "code" in error && error.code === "CODEX_APP_SERVER_STARTUP_CANCELLED" && "reason" in error && (error.reason === "aborted" || error.reason === "timed_out") && (reason === void 0 || error.reason === reason);
+}
+function resolvePositiveIntegerTimeoutMs(value, fallbackMs) {
+	const fallback = resolveTimerTimeoutMs(fallbackMs, 1);
+	return resolveTimerTimeoutMs(value, fallback);
+}
+/** Runs startup work with abort and timeout handling plus optional cleanup. */
+async function withCodexStartupTimeout(params) {
+	if (params.signal.aborted) throw new CodexAppServerStartupError("aborted");
+	let timeout;
+	let abortCleanup;
+	let timeoutError;
+	let timeoutCleanup;
+	try {
+		return await Promise.race([params.operation(), new Promise((_, reject) => {
+			const rejectOnce = (error) => {
+				if (timeout) {
+					clearTimeout(timeout);
+					timeout = void 0;
+				}
+				reject(error);
+			};
+			timeout = setTimeout(() => {
+				timeoutError = new CodexAppServerStartupError("timed_out");
+				timeoutCleanup = Promise.resolve(params.onTimeout?.()).then(() => void 0, () => void 0);
+				timeoutCleanup.finally(() => {
+					rejectOnce(timeoutError);
+				});
+			}, params.timeoutMs);
+			const abortListener = () => rejectOnce(new CodexAppServerStartupError("aborted"));
+			params.signal.addEventListener("abort", abortListener, { once: true });
+			abortCleanup = () => params.signal.removeEventListener("abort", abortListener);
+		})]);
+	} catch (error) {
+		if (timeoutError) {
+			await timeoutCleanup;
+			throw timeoutError;
+		}
+		throw error;
+	} finally {
+		if (timeout) clearTimeout(timeout);
+		abortCleanup?.();
+	}
+}
+/** Resolves startup timeout while honoring the configured floor. */
+function resolveCodexStartupTimeoutMs(params) {
+	const timeoutFloorMs = resolvePositiveIntegerTimeoutMs(params.timeoutFloorMs, CODEX_APP_SERVER_STARTUP_TIMEOUT_FLOOR_MS);
+	const timeoutMs = resolvePositiveIntegerTimeoutMs(params.timeoutMs, timeoutFloorMs);
+	return Math.max(timeoutFloorMs, timeoutMs);
+}
+/** Adds gateway grace time to a caller timeout without overflowing invalid values. */
+function resolveCodexGatewayTimeoutWithGraceMs(timeoutMs, graceMs = 1e4) {
+	const timeout = resolvePositiveIntegerTimeoutMs(timeoutMs, 1);
+	const grace = resolveTimerTimeoutMs(graceMs, 0, 0);
+	return addTimerTimeoutGraceMs(timeout, grace) ?? timeout;
+}
+//#endregion
 //#region extensions/codex/src/app-server/computer-use-service-path.ts
 /** Filesystem ownership guards for isolated Computer Use service provisioning. */
 async function assertOwnedServicePath(params) {
@@ -239,6 +313,7 @@ async function ensureRealDirectoryCopy(cachePath, sourcePluginRoot, version, bou
 	let backupCreated = false;
 	try {
 		await fs$1.cp(sourcePluginRoot, stagedPath, { recursive: true });
+		await waitForCodexDesktopGeneration();
 		if (ownedParent) await assertDirectoryIdentityStable(ownedParent, "Computer Use plugin cache parent");
 		if (stat) {
 			boundary.assertCurrent?.();
@@ -524,7 +599,9 @@ async function ensureCodexComputerUseServiceAppOnce(params) {
 		if (!stagedIdentity || !identitiesMatch(stagedIdentity, sourceIdentity)) throw new Error(`Copied Computer Use service app at ${stagedPath} does not match its selected signed source.`);
 		const stagedSnapshot = await readServiceAppSnapshot(stagedPath, inspectServiceApp);
 		const currentSourceIdentity = await inspectServiceApp(sourcePath);
+		await waitForCodexDesktopGeneration();
 		await assertOwnedServiceParentStable(ownedParent);
+		await assertDirectoryIdentityStable(stagingRootIdentity, "Computer Use service staging directory");
 		if (!currentSourceIdentity || !identitiesMatch(currentSourceIdentity, sourceIdentity)) throw new Error("Selected Computer Use service source changed during refresh.");
 		await assertNotSymlink(operationTargetPath, "Computer Use service target");
 		if (await pathExists$1(operationTargetPath)) {
@@ -1017,7 +1094,9 @@ async function reconcileCodexComputerUseStartArtifactsOnce(params) {
 	const computerUseConfig = resolveCodexComputerUseConfig({ pluginConfig: params.pluginConfig });
 	const ownsIsolatedCodexHome = params.ownsIsolatedCodexHome ?? (params.startOptions.homeScope !== "user" && !params.startOptions.env?.[CODEX_HOME_ENV_VAR]?.trim());
 	const shouldProvisionComputerUse = computerUseConfig.enabled && computerUseConfig.autoInstall && ownsIsolatedCodexHome;
-	if (shouldProvisionComputerUse) await ensureOwnedCodexHome(codexHome, params.agentDir);
+	const provisioningAgentDir = shouldProvisionComputerUse ? params.agentDir : void 0;
+	if (shouldProvisionComputerUse && !provisioningAgentDir) throw new Error("Managed Codex Computer Use requires an OpenClaw agent directory");
+	if (provisioningAgentDir) await ensureOwnedCodexHome(codexHome, provisioningAgentDir);
 	else await fs$1.mkdir(codexHome, { recursive: true });
 	const desktopCandidates = resolveMacOSDesktopCodexAppPathCandidates();
 	const exactDesktopCandidate = desktopCandidates.find((candidate) => path.resolve(candidate.appServerCommandPath) === path.resolve(params.startOptions.command));
@@ -1028,12 +1107,12 @@ async function reconcileCodexComputerUseStartArtifactsOnce(params) {
 		needsBundledMarketplace
 	}) : exactDesktopCandidate;
 	params.assertCurrent();
-	if (shouldProvisionComputerUse) {
+	if (provisioningAgentDir) {
 		if (desktopCandidates.length > 0 && !artifactCandidate) throw new CodexComputerUseCandidateArtifactsUnavailableError();
 		try {
 			const marketplacePath = usesManagedBundledMarketplace ? await ensureCodexManagedBundledMarketplace({
 				codexHome,
-				ownershipRoot: params.agentDir,
+				ownershipRoot: provisioningAgentDir,
 				...artifactCandidate ? {
 					appServerCommand: artifactCandidate.appServerCommandPath,
 					candidates: [artifactCandidate],
@@ -1112,11 +1191,12 @@ async function applyCodexAppServerAuthProfile(params) {
 		await assertNativeCodexAccountMatchesRoute(params.client, params.authRequirement, params.assertCurrent);
 		return;
 	}
+	const agentDir = params.agentDir ?? resolveDefaultAgentDir(params.config ?? {});
 	let loginParams = params.preparedAuth?.kind === "profile" ? params.preparedAuth.snapshot.loginParams : params.preparedAuth?.kind === "api-key" ? {
 		type: "apiKey",
 		apiKey: params.preparedAuth.apiKey
 	} : await resolveCodexAppServerAuthProfileLoginParams({
-		agentDir: params.agentDir,
+		agentDir,
 		authProfileId: params.authProfileId ?? void 0,
 		authProfileStore: params.authProfileStore,
 		config: params.config
@@ -1131,7 +1211,16 @@ async function applyCodexAppServerAuthProfile(params) {
 			assertCurrent: params.assertCurrent
 		});
 	}
-	if (loginParams) await params.client.request("account/login/start", loginParams, { assertCurrent: params.assertCurrent });
+	if (loginParams) {
+		await params.client.request("account/login/start", loginParams, { assertCurrent: params.assertCurrent });
+		if (loginParams.type === "chatgptAuthTokens") {
+			params.assertCurrent?.();
+			return {
+				accessFingerprint: fingerprintTokenAuthProfileCacheKey(loginParams.accessToken),
+				chatgptAccountId: loginParams.chatgptAccountId
+			};
+		}
+	}
 }
 /**
 * Native-home connections are verified, never logged into. Both directions of the
@@ -1178,6 +1267,8 @@ async function resolveCodexAppServerAuthProfileLoginParams(params) {
 }
 async function refreshCodexAppServerAuthTokens(params) {
 	const previousAccountId = params.previousAccountId?.trim();
+	const handoffAccountId = params.authHandoff?.chatgptAccountId.trim();
+	if (previousAccountId && handoffAccountId && previousAccountId !== handoffAccountId) throw new Error("ChatGPT workspace changed before Codex token refresh. Retry to start a client for the selected workspace.");
 	if (previousAccountId) {
 		const store = resolveCodexAppServerAuthProfileStore(params);
 		const profileId = resolveCodexAppServerAuthProfileId({
@@ -1195,6 +1286,7 @@ async function refreshCodexAppServerAuthTokens(params) {
 	});
 	if (!loginParams || loginParams.type !== "chatgptAuthTokens") throw new Error("Codex app-server ChatGPT token refresh requires an OAuth auth profile. Sign in with `openclaw models auth login --provider openai`, select that profile, then retry.");
 	if (previousAccountId && loginParams.chatgptAccountId !== previousAccountId) throw new Error("ChatGPT workspace changed during Codex token refresh. Retry to start a client for the selected workspace.");
+	if (params.authHandoff && loginParams.chatgptAccountId !== params.authHandoff.chatgptAccountId) throw new Error("ChatGPT workspace changed during Codex token refresh. Retry to start a client for the selected workspace.");
 	return {
 		accessToken: loginParams.accessToken,
 		chatgptAccountId: loginParams.chatgptAccountId,
@@ -1222,6 +1314,8 @@ async function resolveCodexAppServerAuthProfileLoginParamsInternal(params) {
 		store,
 		preferStoreCredential: Boolean(params.authProfileStore?.profiles[profileId]),
 		forceOAuthRefresh: params.forceOAuthRefresh === true,
+		authHandoff: params.authHandoff,
+		previousAccountId: params.previousAccountId,
 		config: params.config
 	});
 	if (!loginParams) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" does not contain usable credentials. Repair or replace the selected OpenAI credential, then retry.`);
@@ -1268,6 +1362,8 @@ async function resolveLoginParamsForCredential(profileId, credential, params) {
 		store: params.store,
 		preferStoreCredential: params.preferStoreCredential,
 		forceRefresh: params.forceOAuthRefresh,
+		authHandoff: params.authHandoff,
+		previousAccountId: params.previousAccountId,
 		config: params.config
 	});
 	const accessToken = resolvedCredential.access?.trim();
@@ -1286,9 +1382,9 @@ async function resolveOAuthCredentialForCodexAppServer(profileId, credential, pa
 		store: params.store,
 		profileId,
 		persistedCredential,
-		suppliedCredential: credential,
-		config: params.config
+		suppliedCredential: credential
 	});
+	if (params.preferStoreCredential && params.store.runtimePersistedProfileIds?.includes(profileId) && (persistedCredential?.type !== "oauth" || !isCodexAppServerAuthProvider(persistedCredential.provider))) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" is no longer available. Sign in again with OpenClaw, then retry.`);
 	const store = useScopedCredential ? params.store : resolveCodexAppServerAuthProfileStore({
 		agentDir: ownerAgentDir,
 		authProfileId: profileId,
@@ -1297,15 +1393,28 @@ async function resolveOAuthCredentialForCodexAppServer(profileId, credential, pa
 	const persistedOAuthCredential = !useScopedCredential && persistedCredential?.type === "oauth" && isCodexAppServerAuthProvider(persistedCredential.provider) ? persistedCredential : void 0;
 	const ownerCredential = store.profiles[profileId];
 	const overlaidOAuthCredential = ownerCredential?.type === "oauth" && isCodexAppServerAuthProvider(ownerCredential.provider) ? ownerCredential : void 0;
+	const currentCredential = useScopedCredential || !persistedOAuthCredential ? overlaidOAuthCredential : persistedOAuthCredential;
+	const reuseCompletedRotation = params.forceRefresh && (Boolean(persistedOAuthCredential) || params.preferStoreCredential) && shouldReuseCompletedCodexOAuthRotation({
+		credential: currentCredential,
+		authHandoff: params.authHandoff,
+		previousAccountId: params.previousAccountId
+	});
+	const selectedAccountId = currentCredential ? resolveOpenAICodexAuthIdentity(currentCredential).accountId?.trim() : void 0;
+	const callbackAccountId = params.authHandoff?.chatgptAccountId.trim() ?? params.previousAccountId?.trim() ?? void 0;
+	if (callbackAccountId && selectedAccountId && callbackAccountId !== selectedAccountId) throw new Error("ChatGPT workspace changed before Codex token refresh. Retry to start a client for the selected workspace.");
+	const expectedAccountId = callbackAccountId ?? selectedAccountId;
 	if (useScopedCredential && overlaidOAuthCredential) return await resolveScopedOAuthCredential({
 		store,
 		profileId,
 		credential: overlaidOAuthCredential,
-		forceRefresh: params.forceRefresh
+		forceRefresh: params.forceRefresh && !reuseCompletedRotation,
+		expectedAccountId
 	});
 	if (params.forceRefresh && !persistedOAuthCredential && overlaidOAuthCredential) {
+		if (reuseCompletedRotation) return overlaidOAuthCredential;
 		const refreshedRuntimeCredential = await refreshOAuthCredentialForRuntime({ credential: overlaidOAuthCredential });
 		if (!refreshedRuntimeCredential?.access?.trim()) throw new Error(`Codex app-server auth profile "${profileId}" could not refresh. Sign in again with OpenClaw, then retry.`);
+		assertCodexOAuthRefreshWorkspace(profileId, refreshedRuntimeCredential, expectedAccountId);
 		store.profiles[profileId] = refreshedRuntimeCredential;
 		return refreshedRuntimeCredential;
 	}
@@ -1313,23 +1422,30 @@ async function resolveOAuthCredentialForCodexAppServer(profileId, credential, pa
 		store,
 		profileId,
 		agentDir: ownerAgentDir,
-		forceRefresh: params.forceRefresh && Boolean(persistedOAuthCredential)
+		forceRefresh: params.forceRefresh && Boolean(persistedOAuthCredential) && !reuseCompletedRotation,
+		allowProfileFallback: false,
+		...expectedAccountId ? { validateOAuthCredential: (candidate) => assertCodexOAuthRefreshWorkspace(profileId, candidate, expectedAccountId) } : {}
 	});
-	const refreshed = useScopedCredential ? void 0 : loadAuthProfileStoreForSecretsRuntime(ownerAgentDir, { profileId }).profiles[profileId];
-	const refreshedOAuthCredential = refreshed?.type === "oauth" && isCodexAppServerAuthProvider(refreshed.provider) ? refreshed : void 0;
-	if (refreshedOAuthCredential && isDeepStrictEqual(params.store.profiles[profileId], credential)) params.store.profiles[profileId] = refreshedOAuthCredential;
-	const storedCredential = store.profiles[profileId];
-	const candidate = refreshedOAuthCredential ? refreshedOAuthCredential : storedCredential?.type === "oauth" && isCodexAppServerAuthProvider(storedCredential.provider) ? storedCredential : credential;
-	return resolved?.apiKey ? {
-		...candidate,
+	if (!resolved || resolved.credential?.type !== "oauth" || !isCodexAppServerAuthProvider(resolved.credential.provider) || !resolved.apiKey.trim()) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" is no longer available. Sign in again with OpenClaw, then retry.`);
+	const candidate = {
+		...resolved.credential,
 		access: resolved.apiKey
-	} : candidate;
+	};
+	if (isDeepStrictEqual(params.store.profiles[profileId], credential)) params.store.profiles[profileId] = candidate;
+	return candidate;
+}
+function shouldReuseCompletedCodexOAuthRotation(params) {
+	const handoff = params.authHandoff;
+	const credential = params.credential;
+	if (!handoff || !credential || !hasUsableOAuthCredential(credential) || fingerprintTokenAuthProfileCacheKey(credential.access.trim()) === handoff.accessFingerprint) return false;
+	const accountId = resolveOpenAICodexAuthIdentity(credential).accountId?.trim();
+	const previousAccountId = params.previousAccountId?.trim();
+	return accountId === handoff.chatgptAccountId && (!previousAccountId || previousAccountId === handoff.chatgptAccountId);
 }
 function shouldUseScopedOAuthCredential(params) {
 	if (!params.store.runtimePersistedProfileIds?.includes(params.profileId)) return true;
 	const persisted = params.persistedCredential;
-	if (persisted?.type !== "oauth") return true;
-	if (resolveProviderIdForAuth(persisted.provider, { config: params.config }) !== resolveProviderIdForAuth(params.suppliedCredential.provider, { config: params.config })) return true;
+	if (persisted?.type !== "oauth" || !isCodexAppServerAuthProvider(persisted.provider)) return false;
 	return !isDeepStrictEqual(persisted, params.suppliedCredential) && !hasMatchingOAuthIdentity(persisted, params.suppliedCredential);
 }
 function hasMatchingOAuthIdentity(persisted, supplied) {
@@ -1342,7 +1458,11 @@ function hasMatchingOAuthIdentity(persisted, supplied) {
 }
 async function resolveScopedOAuthCredential(params) {
 	const existingRefresh = scopedOAuthRefreshQueues.get(params.store)?.get(params.profileId);
-	if (existingRefresh) return await existingRefresh;
+	if (existingRefresh) {
+		const refreshed = await existingRefresh;
+		assertCodexOAuthRefreshWorkspace(params.profileId, refreshed, params.expectedAccountId);
+		return refreshed;
+	}
 	if (!params.forceRefresh && hasUsableOAuthCredential(params.credential)) return params.credential;
 	const storeRefreshes = scopedOAuthRefreshQueues.get(params.store) ?? /* @__PURE__ */ new Map();
 	scopedOAuthRefreshQueues.set(params.store, storeRefreshes);
@@ -1352,6 +1472,7 @@ async function resolveScopedOAuthCredential(params) {
 		if (!params.forceRefresh && hasUsableOAuthCredential(credential)) return credential;
 		const refreshed = await refreshOAuthCredentialForRuntime({ credential });
 		if (!refreshed?.access?.trim()) throw new Error(`Codex app-server auth profile "${params.profileId}" could not refresh. Sign in again with OpenClaw, then retry.`);
+		assertCodexOAuthRefreshWorkspace(params.profileId, refreshed, params.expectedAccountId);
 		if (!isDeepStrictEqual(params.store.profiles[params.profileId], credential)) throw new Error(`Codex app-server auth profile "${params.profileId}" changed while refreshing. Retry with the newly selected OpenAI profile.`);
 		params.store.profiles[params.profileId] = refreshed;
 		return refreshed;
@@ -1363,6 +1484,11 @@ async function resolveScopedOAuthCredential(params) {
 		if (storeRefreshes.get(params.profileId) === refresh) storeRefreshes.delete(params.profileId);
 	}
 }
+function assertCodexOAuthRefreshWorkspace(profileId, credential, expectedAccountId) {
+	if (!expectedAccountId) return;
+	const loginParams = buildChatgptAuthTokensParams(profileId, credential, credential.access.trim());
+	if (loginParams.type !== "chatgptAuthTokens" || loginParams.chatgptAccountId !== expectedAccountId) throw new Error("ChatGPT workspace changed during Codex token refresh. Retry to start a client for the selected workspace.");
+}
 function isCodexAppServerAuthProvider(provider) {
 	return provider.trim().toLowerCase() === CODEX_APP_SERVER_AUTH_PROVIDER;
 }
@@ -1417,6 +1543,65 @@ function resolveExplicitChatgptAccountId(credential) {
 	}
 }
 //#endregion
+//#region extensions/codex/src/app-server/client-thread-owner.ts
+function createThreadOwnerToken(threadId, onInvalidated) {
+	const owner = {
+		invalidated: false,
+		invalidate: () => {
+			if (owner.invalidated) return;
+			owner.invalidated = true;
+			try {
+				onInvalidated?.();
+			} catch (error) {
+				embeddedAgentLog$1.warn("codex thread ownership invalidation failed", {
+					threadId,
+					reason: formatErrorMessage(error)
+				});
+			}
+		}
+	};
+	return owner;
+}
+function hasThreadOwnership(runtime, threadId) {
+	return runtime !== void 0 && !runtime.closed && (runtime.retainedThreads.get(threadId) !== void 0 || runtime.releasingThreads.get(threadId) !== void 0 || runtime.claimedThreads.get(threadId) !== void 0);
+}
+function hasSiblingThreadWork(runtime, threadId) {
+	if (!runtime || runtime.closed) return false;
+	if (runtime.protectedThreads.size > 0) return true;
+	for (const [retainedThreadId, retained] of runtime.retainedThreads) if (retainedThreadId !== threadId && retained.ephemeralPolicy !== void 0) return true;
+	for (const claimedThreadId of runtime.claimedThreads.keys()) if (claimedThreadId !== threadId) return true;
+	return false;
+}
+function invalidateThreadOwnership(runtime, threadId) {
+	const retainedOwner = runtime.retainedThreads.get(threadId)?.ownerToken;
+	const claimedOwner = runtime.claimedThreads.get(threadId);
+	const releasing = runtime.releasingThreads.get(threadId);
+	if (releasing) releasing.invalidated = true;
+	runtime.retainedThreads.delete(threadId);
+	runtime.claimedThreads.delete(threadId);
+	retainedOwner?.invalidate();
+	claimedOwner?.invalidate();
+	releasing?.retainedOwnerToken?.invalidate();
+}
+function forgetThreadOwnership(runtime, threadId, owner) {
+	let forgotten = false;
+	if (runtime.claimedThreads.get(threadId) === owner) {
+		runtime.claimedThreads.delete(threadId);
+		forgotten = true;
+	}
+	if (runtime.retainedThreads.get(threadId)?.ownerToken === owner) {
+		runtime.retainedThreads.delete(threadId);
+		forgotten = true;
+	}
+	const releasing = runtime.releasingThreads.get(threadId);
+	if (releasing?.retainedOwnerToken === owner) {
+		releasing.invalidated = true;
+		forgotten = true;
+	}
+	if (forgotten) owner.invalidate();
+	return forgotten;
+}
+//#endregion
 //#region extensions/codex/src/app-server/rate-limit-cache.ts
 const DEFAULT_CODEX_RATE_LIMIT_CACHE_MAX_AGE_MS = 6e5;
 const SPARSE_ACCOUNT_METADATA_KEYS = [
@@ -1531,6 +1716,10 @@ function isCodexAppServerClientRuntimeLive(client) {
 	const runtime = configuredClients.get(client);
 	return runtime !== void 0 && !runtime.closed;
 }
+function recordCodexAppServerAuthHandoff(client, handoff) {
+	const runtime = configuredClients.get(client);
+	if (runtime && !runtime.closed && handoff) runtime.authHandoff = handoff;
+}
 /** Reference history is only trusted while this native subscription stays warm. */
 function forgetCodexWorkspaceReferences(client, threadId) {
 	configuredClients.get(client)?.workspaceReferences.delete(threadId);
@@ -1606,8 +1795,11 @@ function ensureCodexAppServerClientRuntime(client, context) {
 			clearTimeout(runtime.evictionTimer);
 			runtime.evictionTimer = void 0;
 		}
-		runtime.retainedThreads.clear();
-		runtime.claimedThreads.clear();
+		for (const threadId of /* @__PURE__ */ new Set([
+			...runtime.retainedThreads.keys(),
+			...runtime.claimedThreads.keys(),
+			...runtime.releasingThreads.keys()
+		])) invalidateThreadOwnership(runtime, threadId);
 		runtime.protectedThreads.clear();
 		runtime.sessionMetadata.clear();
 		runtime.workspaceReferences.clear();
@@ -1615,16 +1807,24 @@ function ensureCodexAppServerClientRuntime(client, context) {
 	client.addRequestHandler(async (request) => {
 		if (request.method !== "account/chatgptAuthTokens/refresh") return;
 		if (runtime.context.authMode === "prepared-api-key") throw new Error("ChatGPT token refresh is unavailable for prepared Codex API-key auth.");
+		if (!runtime.context.agentDir) throw new Error("ChatGPT token refresh requires an OpenClaw-owned auth profile.");
 		const previousAccountId = isJsonObject(request.params) && typeof request.params.previousAccountId === "string" ? request.params.previousAccountId.trim() || void 0 : void 0;
+		const authHandoff = runtime.authHandoff;
 		try {
 			const tokens = await withTimeout(refreshCodexAppServerAuthTokens({
 				agentDir: runtime.context.agentDir,
 				authProfileId: runtime.context.authProfileId,
+				...authHandoff ? { authHandoff } : {},
 				...previousAccountId ? { previousAccountId } : {},
 				...runtime.context.authProfileStore ? { authProfileStore: runtime.context.authProfileStore } : {},
 				config: runtime.context.config
 			}), CODEX_EXTERNAL_AUTH_REFRESH_TIMEOUT_MS, "Codex app-server ChatGPT token refresh timed out before its external-auth deadline. Retry the request; if it persists, sign in again with OpenClaw.");
 			if (previousAccountId && tokens.chatgptAccountId !== previousAccountId) throw new Error("ChatGPT workspace changed during Codex token refresh. Retry to start a client for the selected workspace.");
+			if (runtime.closed) throw new Error("Codex app-server client closed during ChatGPT token refresh.");
+			runtime.authHandoff = {
+				accessFingerprint: fingerprintTokenAuthProfileCacheKey(tokens.accessToken),
+				chatgptAccountId: tokens.chatgptAccountId
+			};
 			return { ...tokens };
 		} catch (error) {
 			runtime.context.onAuthRefreshFailure?.();
@@ -1647,10 +1847,7 @@ function ensureCodexAppServerClientRuntime(client, context) {
 		if (notification.method === "thread/archived" || notification.method === "thread/deleted" || notification.method === "thread/closed") {
 			const threadId = notification.params?.threadId;
 			if (typeof threadId === "string") {
-				const releasing = runtime.releasingThreads.get(threadId);
-				if (releasing) releasing.invalidated = true;
-				runtime.retainedThreads.delete(threadId);
-				runtime.claimedThreads.delete(threadId);
+				invalidateThreadOwnership(runtime, threadId);
 				runtime.sessionMetadata.delete(threadId);
 				runtime.workspaceReferences.delete(threadId);
 				scheduleRetainedThreadEviction(client, runtime);
@@ -1691,14 +1888,18 @@ async function releaseRetainedThread(client, runtime, threadId, assertCurrent) {
 	}
 	runtime.retainedThreads.delete(threadId);
 	scheduleRetainedThreadEviction(client, runtime);
-	const transition = { completion: Promise.resolve().then(() => {
-		assertCurrent?.();
-		return assertCurrent ? retained.release(threadId, assertCurrent) : retained.release(threadId);
-	}) };
+	const transition = {
+		retainedOwnerToken: retained.ownerToken,
+		completion: Promise.resolve().then(() => {
+			assertCurrent?.();
+			return assertCurrent ? retained.release(threadId, assertCurrent) : retained.release(threadId);
+		})
+	};
 	runtime.releasingThreads.set(threadId, transition);
 	try {
 		await transition.completion;
 		runtime.workspaceReferences.delete(threadId);
+		retained.ownerToken?.invalidate();
 		return true;
 	} catch (error) {
 		if (!runtime.closed && !transition.invalidated && runtime.releasingThreads.get(threadId) === transition && !runtime.retainedThreads.has(threadId) && !runtime.claimedThreads.has(threadId)) {
@@ -1732,14 +1933,17 @@ async function retainCodexAppServerLiveThread(client, threadId, releaseThread, c
 	const runtime = configuredClients.get(client);
 	if (!runtime || runtime.closed) return false;
 	const claimed = runtime.claimedThreads.get(threadId);
-	if (claimed !== void 0 && (releaseThread === void 0 || claimedThreadReleaseTokens.get(releaseThread) !== claimed)) return false;
+	const ownerToken = releaseThread ? claimedThreadReleaseTokens.get(releaseThread) : void 0;
+	if (claimed !== ownerToken || ownerToken?.invalidated) return false;
 	const pendingRelease = runtime.releasingThreads.get(threadId);
 	if (pendingRelease) {
 		await pendingRelease.completion;
 		return false;
 	}
+	const previousOwner = runtime.retainedThreads.get(threadId)?.ownerToken;
 	runtime.retainedThreads.delete(threadId);
 	const retained = {
+		ownerToken,
 		configFingerprint,
 		ephemeralPolicy,
 		serviceTier,
@@ -1749,6 +1953,7 @@ async function retainCodexAppServerLiveThread(client, threadId, releaseThread, c
 		})
 	};
 	runtime.retainedThreads.set(threadId, retained);
+	if (previousOwner !== ownerToken) previousOwner?.invalidate();
 	try {
 		await evictExcessIdleThreads(client, runtime);
 	} catch (error) {
@@ -1778,8 +1983,8 @@ async function consumeCodexAppServerLiveThread(client, threadId, configFingerpri
 	if (!retained || configFingerprint !== void 0 && retained.configFingerprint !== configFingerprint) return;
 	return claimCodexAppServerThreadOwnership(client, runtime, threadId, retained);
 }
-/** Claims an observed Codex auto-subscription without exposing a temporarily idle owner. */
-async function claimCodexAppServerLiveThread(client, threadId) {
+/** Claims an auto-subscription; invalidation ends the handle after replacement or release. */
+async function claimCodexAppServerLiveThread(client, threadId, onInvalidated) {
 	const runtime = configuredClients.get(client);
 	if (!runtime || runtime.closed || runtime.claimedThreads.has(threadId)) return;
 	const pendingRelease = runtime.releasingThreads.get(threadId);
@@ -1792,21 +1997,33 @@ async function claimCodexAppServerLiveThread(client, threadId) {
 		release: async (releasedThreadId, assertCurrent) => {
 			await unsubscribeCodexAppServerLiveThread(client, releasedThreadId, 5e3, assertCurrent);
 		}
-	});
+	}, onInvalidated);
 }
-function claimCodexAppServerThreadOwnership(client, runtime, threadId, retained) {
+function claimCodexAppServerThreadOwnership(client, runtime, threadId, retained, onInvalidated) {
+	const previousClaim = runtime.claimedThreads.get(threadId);
 	runtime.retainedThreads.delete(threadId);
-	const claimed = Symbol(threadId);
+	const claimed = createThreadOwnerToken(threadId, onInvalidated);
 	runtime.claimedThreads.set(threadId, claimed);
+	previousClaim?.invalidate();
+	retained.ownerToken?.invalidate();
 	scheduleRetainedThreadEviction(client, runtime);
 	const assertCurrent = () => {
-		if (runtime.closed || runtime.claimedThreads.get(threadId) !== claimed) throw new Error(`Codex thread subscription ownership changed: ${threadId}`);
+		if (claimed.invalidated || runtime.closed || runtime.claimedThreads.get(threadId) !== claimed) throw new Error(`Codex thread subscription ownership changed: ${threadId}`);
 	};
 	const release = async (releasedThreadId, assertReleaseCurrent) => {
-		if (releasedThreadId !== threadId || runtime.claimedThreads.get(threadId) !== claimed) {
+		if (releasedThreadId !== threadId || claimed.invalidated) {
 			assertReleaseCurrent?.();
 			return;
 		}
+		if (runtime.claimedThreads.get(threadId) !== claimed) {
+			if (runtime.retainedThreads.get(threadId)?.ownerToken === claimed) await releaseRetainedThread(client, runtime, threadId, assertReleaseCurrent);
+			else {
+				const pendingRelease = runtime.releasingThreads.get(threadId);
+				if (pendingRelease?.retainedOwnerToken === claimed) await pendingRelease.completion;
+				assertReleaseCurrent?.();
+			}
+			return;
+		}
 		const pendingRelease = runtime.releasingThreads.get(threadId);
 		if (pendingRelease) {
 			await pendingRelease.completion;
@@ -1826,6 +2043,7 @@ function claimCodexAppServerThreadOwnership(client, runtime, threadId, retained)
 			if (runtime.claimedThreads.get(threadId) === claimed) {
 				runtime.claimedThreads.delete(threadId);
 				runtime.workspaceReferences.delete(threadId);
+				claimed.invalidate();
 			}
 		} finally {
 			if (runtime.releasingThreads.get(threadId) === transition) runtime.releasingThreads.delete(threadId);
@@ -1838,18 +2056,26 @@ function claimCodexAppServerThreadOwnership(client, runtime, threadId, retained)
 		configFingerprint: retained.configFingerprint,
 		ephemeralPolicy: retained.ephemeralPolicy,
 		serviceTier: retained.serviceTier,
-		release
+		release,
+		forget: () => {
+			if (forgetThreadOwnership(runtime, threadId, claimed)) {
+				runtime.workspaceReferences.delete(threadId);
+				scheduleRetainedThreadEviction(client, runtime);
+			}
+		}
 	};
 }
 /** Distinguish active claimed ownership from an already-evicted idle subscription. */
 function hasCodexAppServerLiveThread(client, threadId) {
-	const runtime = configuredClients.get(client);
-	return runtime !== void 0 && !runtime.closed && (runtime.retainedThreads.has(threadId) || runtime.releasingThreads.has(threadId) || runtime.claimedThreads.has(threadId));
+	return hasThreadOwnership(configuredClients.get(client), threadId);
 }
 function isCodexAppServerLiveThreadClaimed(client, threadId) {
 	const runtime = configuredClients.get(client);
 	return runtime !== void 0 && !runtime.closed && runtime.claimedThreads.has(threadId);
 }
+function hasCodexAppServerSiblingThreadWork(client, threadId) {
+	return hasSiblingThreadWork(configuredClients.get(client), threadId);
+}
 /** Release the exact physical subscription and finish only its observed ownership generation. */
 async function unsubscribeCodexAppServerLiveThread(client, threadId, timeoutMs, assertCurrent) {
 	const runtime = configuredClients.get(client);
@@ -1887,9 +2113,13 @@ async function unsubscribeCodexAppServerLiveThread(client, threadId, timeoutMs,
 		await physicalRelease;
 		if (retained !== void 0 && runtime?.retainedThreads.get(threadId) === retained) {
 			runtime.retainedThreads.delete(threadId);
+			retained.ownerToken?.invalidate();
 			scheduleRetainedThreadEviction(client, runtime);
 		}
-		if (claimed !== void 0 && runtime?.claimedThreads.get(threadId) === claimed) runtime.claimedThreads.delete(threadId);
+		if (claimed !== void 0 && runtime?.claimedThreads.get(threadId) === claimed) {
+			runtime.claimedThreads.delete(threadId);
+			claimed.invalidate();
+		}
 	} finally {
 		if (ownsTransition && runtime.releasingThreads.get(threadId) === transition) runtime.releasingThreads.delete(threadId);
 	}
@@ -1930,79 +2160,144 @@ function protectCodexAppServerLiveThread(client, threadId) {
 	};
 }
 //#endregion
-//#region extensions/codex/src/app-server/attempt-timeouts.ts
-/**
-* Timeout defaults and normalizers for Codex app-server startup and turn
-* liveness watches.
-*/
-/** Minimum startup timeout accepted by the Codex app-server harness. */
-const CODEX_APP_SERVER_STARTUP_TIMEOUT_FLOOR_MS = 100;
-const TURN_TERMINAL_SETTLEMENT_TIMEOUT_MS = 12e4;
-const TURN_FINALIZE_DRAIN_ABORT_GRACE_MS = 5e3;
-var CodexAppServerStartupError = class extends Error {
-	constructor(reason, message = reason === "timed_out" ? "codex app-server startup timed out" : "codex app-server startup aborted") {
-		super(message);
-		this.reason = reason;
-		this.code = "CODEX_APP_SERVER_STARTUP_CANCELLED";
-		this.name = "CodexAppServerStartupError";
-	}
-};
-function isCodexAppServerStartupError(error, reason) {
-	return error instanceof Error && "code" in error && error.code === "CODEX_APP_SERVER_STARTUP_CANCELLED" && "reason" in error && (error.reason === "aborted" || error.reason === "timed_out") && (reason === void 0 || error.reason === reason);
-}
-function resolvePositiveIntegerTimeoutMs(value, fallbackMs) {
-	const fallback = resolveTimerTimeoutMs(fallbackMs, 1);
-	return resolveTimerTimeoutMs(value, fallback);
+//#region extensions/codex/src/app-server/inference-routing.ts
+const owners = defineCodexBuildState("openclaw.codexAppServerInferenceOwners", () => /* @__PURE__ */ new WeakMap())();
+const MAX_ROUTES = 8;
+const MAX_THREADS = 256;
+const NATIVE_OPENAI_UPSTREAMS = /* @__PURE__ */ new Set(["https://api.openai.com/v1", "https://chatgpt.com/backend-api/codex"]);
+/** Only managed native stdio startup calls this; locality or metadata cannot opt a client in. */
+function ownCodexInferenceClient(client) {
+	if (owners.has(client)) return;
+	const owner = {
+		closed: false,
+		routes: /* @__PURE__ */ new Map(),
+		threads: /* @__PURE__ */ new Map(),
+		handles: /* @__PURE__ */ new Set()
+	};
+	owners.set(client, owner);
+	const close = () => {
+		owner.closed = true;
+		owner.threads.clear();
+		owner.handles.clear();
+		for (const pending of owner.routes.values()) pending.then((route) => route.close(), () => {});
+		owner.routes.clear();
+	};
+	client.addCloseHandler(close);
+	client.addNotificationHandler((notification) => {
+		if (notification.method === "thread/closed" && isJsonObject(notification.params) && typeof notification.params.threadId === "string") owner.threads.delete(notification.params.threadId);
+		if (notification.method !== "account/updated" || !owner.authRoute) return;
+		const mode = isJsonObject(notification.params) ? notification.params.authMode : void 0;
+		if ((mode === "apiKey" ? "apiKey" : mode === "chatgpt" || mode === "chatgptAuthTokens" ? "chatgpt" : void 0) !== owner.authRoute) close();
+	});
 }
-/** Runs startup work with abort and timeout handling plus optional cleanup. */
-async function withCodexStartupTimeout(params) {
-	if (params.signal.aborted) throw new CodexAppServerStartupError("aborted");
-	let timeout;
-	let abortCleanup;
-	let timeoutError;
-	let timeoutCleanup;
-	try {
-		return await Promise.race([params.operation(), new Promise((_, reject) => {
-			const rejectOnce = (error) => {
-				if (timeout) {
-					clearTimeout(timeout);
-					timeout = void 0;
-				}
-				reject(error);
-			};
-			timeout = setTimeout(() => {
-				timeoutError = new CodexAppServerStartupError("timed_out");
-				timeoutCleanup = Promise.resolve(params.onTimeout?.()).then(() => void 0, () => void 0);
-				timeoutCleanup.finally(() => {
-					rejectOnce(timeoutError);
-				});
-			}, params.timeoutMs);
-			const abortListener = () => rejectOnce(new CodexAppServerStartupError("aborted"));
-			params.signal.addEventListener("abort", abortListener, { once: true });
-			abortCleanup = () => params.signal.removeEventListener("abort", abortListener);
-		})]);
-	} catch (error) {
-		if (timeoutError) {
-			await timeoutCleanup;
-			throw timeoutError;
+async function prepareCodexInferenceRoute(params) {
+	const owner = owners.get(params.client);
+	if (!owner) return;
+	const assertClient = () => {
+		if (owner.closed || owners.get(params.client) !== owner) throw new Error("Codex inference route ownership changed; reconnect before retrying");
+	};
+	const assertCurrent = () => {
+		assertClient();
+		params.signal?.throwIfAborted();
+		params.assertCurrent();
+	};
+	assertCurrent();
+	const snapshot = params.effectiveConfig ?? await readCodexEffectiveConfig(params.client, params.cwd, { signal: params.signal });
+	assertCurrent();
+	if (snapshot.config.model_provider != null && snapshot.config.model_provider !== "openai") return;
+	if (isJsonObject(snapshot.config.features) && snapshot.config.features.respect_system_proxy === true) return;
+	const configured = snapshot.config.openai_base_url;
+	if (configured != null && typeof configured !== "string") throw new Error("Codex inference upstream configuration is invalid");
+	if (configured) {
+		let target;
+		try {
+			target = new URL(configured);
+		} catch {
+			return;
 		}
-		throw error;
-	} finally {
-		if (timeout) clearTimeout(timeout);
-		abortCleanup?.();
+		if (!NATIVE_OPENAI_UPSTREAMS.has(target.href.replace(/\/$/, ""))) return;
 	}
+	const origin = snapshot.origins?.openai_base_url;
+	if (origin && !CODEX_SESSION_OVERRIDABLE_LAYER_TYPES.has(origin.name.type)) return;
+	const account = await params.client.request("account/read", { refreshToken: false }, {
+		signal: params.signal,
+		assertCurrent
+	});
+	assertCurrent();
+	const type = isJsonObject(account.account) ? account.account.type : void 0;
+	if (type !== "apiKey" && type !== "chatgpt") return;
+	if (owner.authRoute && owner.authRoute !== type) throw new Error("Codex native account route changed; reconnect before retrying");
+	owner.authRoute = type;
+	const target = new URL(configured || (type === "apiKey" ? "https://api.openai.com/v1" : "https://chatgpt.com/backend-api/codex"));
+	const key = target.toString();
+	let pending = owner.routes.get(key);
+	if (!pending) {
+		if (owner.routes.size >= MAX_ROUTES) throw new Error("Codex inference route limit reached");
+		pending = import("./inference-proxy-CC15HuSi.mjs").then(({ createCodexInferenceProxy }) => {
+			assertClient();
+			return createCodexInferenceProxy({
+				upstream: target,
+				assertCurrent: assertClient
+			});
+		});
+		owner.routes.set(key, pending);
+	}
+	const route = await pending;
+	assertCurrent();
+	route.assertCurrent();
+	params.client.protectPrivateTransportSecret(new URL(route.baseUrl).pathname.split("/")[1] ?? "");
+	owner.handles.add(route);
+	return route;
+}
+/** Prepare a managed thread without changing an attached or unsupported native profile. */
+async function prepareCodexInferenceThreadConfig(params) {
+	const { binding } = params;
+	if (binding?.connectionScope === "supervision" || binding?.preserveNativeModel === true) return;
+	const route = await prepareCodexInferenceRoute(params);
+	if (!route) return;
+	if (binding?.clientId === params.clientId && !getCodexInferenceThread(params.client, binding.threadId)) {
+		const { thread } = await params.client.request("thread/read", {
+			threadId: binding.threadId,
+			includeTurns: false
+		}, {
+			signal: params.signal,
+			assertCurrent: params.assertCurrent
+		});
+		params.assertCurrent();
+		if (thread.id !== binding.threadId || thread.status?.type !== "notLoaded") throw new Error("Codex loaded thread has no owned inference route; reconnect before retrying");
+	}
+	if (params.config?.openai_base_url !== void 0 && params.config.openai_base_url !== route.upstream) throw new Error("Codex thread configuration conflicts with its trusted inference upstream");
+	return {
+		route,
+		config: {
+			...params.config,
+			openai_base_url: route.baseUrl
+		}
+	};
 }
-/** Resolves startup timeout while honoring the configured floor. */
-function resolveCodexStartupTimeoutMs(params) {
-	const timeoutFloorMs = resolvePositiveIntegerTimeoutMs(params.timeoutFloorMs, CODEX_APP_SERVER_STARTUP_TIMEOUT_FLOOR_MS);
-	const timeoutMs = resolvePositiveIntegerTimeoutMs(params.timeoutMs, timeoutFloorMs);
-	return Math.max(timeoutFloorMs, timeoutMs);
+/** Validate the exact private handle and unchanged upstream, not a localhost string exception. */
+function assertCodexInferenceRouteConfig(client, route, config) {
+	if (!route) return;
+	const owner = owners.get(client);
+	if (!owner || owner.closed || !owner.handles.has(route) || config?.openai_base_url !== route.baseUrl) throw new Error("Codex parent-local inference route was overridden; no turn was sent");
+	route.assertCurrent();
+}
+function bindCodexInferenceThread(client, threadId, route) {
+	const owner = owners.get(client);
+	if (!owner && !route) return;
+	if (!owner || owner.closed) throw new Error("Codex inference client is closed");
+	if (!route) {
+		owner.threads.delete(threadId);
+		return;
+	}
+	route.assertCurrent();
+	if (!owner.threads.has(threadId) && owner.threads.size >= MAX_THREADS) throw new Error("Codex inference thread limit reached; reconnect before retrying");
+	owner.threads.set(threadId, route);
 }
-/** Adds gateway grace time to a caller timeout without overflowing invalid values. */
-function resolveCodexGatewayTimeoutWithGraceMs(timeoutMs, graceMs = 1e4) {
-	const timeout = resolvePositiveIntegerTimeoutMs(timeoutMs, 1);
-	const grace = resolveTimerTimeoutMs(graceMs, 0, 0);
-	return addTimerTimeoutGraceMs(timeout, grace) ?? timeout;
+function getCodexInferenceThread(client, threadId) {
+	const owner = owners.get(client);
+	if (owner?.closed) throw new Error("Codex inference client is closed");
+	return owner?.threads.get(threadId);
 }
 //#endregion
 //#region extensions/codex/src/app-server/native-config-fence.ts
@@ -2067,6 +2362,50 @@ async function waitForPreviousFence(previous, options) {
 	});
 }
 //#endregion
+//#region extensions/codex/src/app-server/native-hook-relay-state.ts
+const pending = /* @__PURE__ */ new Set();
+const closing = /* @__PURE__ */ new Set();
+/** Owns delayed hook-relay cleanup across runtime scheduling and test teardown. */
+const nativeHookRelayUnregisterQueue = {
+	add(entry) {
+		pending.add(entry);
+	},
+	delete(entry) {
+		return pending.delete(entry);
+	},
+	track(operation) {
+		closing.add(operation);
+		operation.then(() => closing.delete(operation), () => closing.delete(operation));
+	},
+	async flush() {
+		while (pending.size > 0) {
+			const entry = pending.values().next().value;
+			if (!entry) break;
+			clearTimeout(entry.timeout);
+			entry.unregister();
+		}
+		while (closing.size > 0) await Promise.allSettled(closing);
+	},
+	async clear() {
+		for (const entry of pending) clearTimeout(entry.timeout);
+		pending.clear();
+		while (closing.size > 0) await Promise.allSettled(closing);
+	}
+};
+//#endregion
+//#region extensions/codex/src/app-server/spawn-identity.ts
+/** Resolves non-secret spawn identity before startup; argv is represented only by its hash. */
+function resolveCodexAppServerSpawnIdentity(startOptions, resolvedNativeCommand) {
+	const nativeCommand = resolvedNativeCommand ?? (startOptions.commandSource === "resolved-managed" ? resolveManagedCodexNativeCommand(startOptions.command) : void 0);
+	return {
+		command: startOptions.command,
+		argsFingerprint: createHash("sha256").update(JSON.stringify(startOptions.args)).digest("hex"),
+		...startOptions.commandSource ? { commandSource: startOptions.commandSource } : {},
+		...startOptions.managedCommandOrder ? { managedCommandOrder: startOptions.managedCommandOrder } : {},
+		...nativeCommand ? { nativeCommand } : {}
+	};
+}
+//#endregion
 //#region extensions/codex/src/app-server/thread-lifecycle-errors.ts
 var CodexThreadStartRequestError = class extends Error {
 	constructor(cause) {
@@ -2074,6 +2413,12 @@ var CodexThreadStartRequestError = class extends Error {
 		this.name = "CodexThreadStartRequestError";
 	}
 };
+var CodexThreadClientReplacementError = class extends AgentHarnessPreflightError$1 {
+	constructor() {
+		super("Codex did not confirm unloading its previous configuration after a settled failure; a fresh client is required.");
+		this.name = "CodexThreadClientReplacementError";
+	}
+};
 var CodexThreadBindingConflictError = class extends Error {
 	constructor(threadId, operation) {
 		super(`Codex thread binding changed while ${operation}: ${threadId}`);
@@ -2109,7 +2454,6 @@ var shared_client_exports = /* @__PURE__ */ __exportAll({
 	readCodexAppServerClientProcessIdentity: () => readCodexAppServerClientProcessIdentity,
 	releaseCodexAppServerClientLease: () => releaseCodexAppServerClientLease,
 	releaseLeasedSharedCodexAppServerClient: () => releaseLeasedSharedCodexAppServerClient,
-	resolveCodexAppServerSpawnIdentity: () => resolveCodexAppServerSpawnIdentity,
 	resolveCodexNativeConfigFenceKey: () => resolveCodexNativeConfigFenceKey,
 	retainSharedCodexAppServerClientByInstanceId: () => retainSharedCodexAppServerClientByInstanceId,
 	retainSharedCodexAppServerClientIfCurrent: () => retainSharedCodexAppServerClientIfCurrent,
@@ -2132,7 +2476,7 @@ async function prepareCodexAppServerClient(options) {
 		if (abandonSignal.aborted) throw new CodexAppServerStartupError("aborted", "codex app-server initialize aborted");
 	};
 	assertCurrent();
-	const startedAt = Date.now();
+	const startedAt = performance.now();
 	return {
 		context: await withCodexAppServerAcquireDeadline(options?.timeoutMs ?? 0, ownCodexStartup(lifetime, resolveCodexAppServerClientStartContext(options)), abandonSignal),
 		lifetime,
@@ -2176,17 +2520,6 @@ async function waitForCodexAppServerClientDesktopGenerationDrain(params) {
 		drain.cancel();
 	}
 }
-/** Resolves non-secret spawn identity before startup; argv is represented only by its hash. */
-function resolveCodexAppServerSpawnIdentity(startOptions, resolvedNativeCommand) {
-	const nativeCommand = resolvedNativeCommand ?? (startOptions.commandSource === "resolved-managed" ? resolveManagedCodexNativeCommand(startOptions.command) : void 0);
-	return {
-		command: startOptions.command,
-		argsFingerprint: createHash("sha256").update(JSON.stringify(startOptions.args)).digest("hex"),
-		...startOptions.commandSource ? { commandSource: startOptions.commandSource } : {},
-		...startOptions.managedCommandOrder ? { managedCommandOrder: startOptions.managedCommandOrder } : {},
-		...nativeCommand ? { nativeCommand } : {}
-	};
-}
 var CodexAppServerStartSelectionChangedError = class extends Error {
 	constructor() {
 		super("Codex app-server managed executable selection changed during startup");
@@ -2221,8 +2554,7 @@ function resolveCodexNativeConfigFenceKey(params) {
 	const startOptions = metadata?.startOptions ?? params.startOptions;
 	if (!startOptions || startOptions.transport !== "stdio") return;
 	const configuredHome = startOptions.env?.CODEX_HOME?.trim();
-	const agentDir = params.agentDir ?? metadata?.agentDir ?? resolveDefaultAgentDir(params.config ?? {});
-	const codexHome = configuredHome ? configuredHome : startOptions.homeScope === "user" ? resolveCodexAppServerUserHomeDir() : agentDir ? resolveCodexAppServerHomeDir(agentDir) : void 0;
+	const codexHome = configuredHome ? configuredHome : startOptions.homeScope === "user" ? resolveCodexAppServerUserHomeDir() : resolveCodexAppServerHomeDir(params.agentDir ?? metadata?.agentDir ?? resolveDefaultAgentDir(params.config ?? {}));
 	return codexHome ? `codex-home:${path.resolve(codexHome)}` : void 0;
 }
 function inferAuthRequirement(preparedAuth) {
@@ -2230,8 +2562,8 @@ function inferAuthRequirement(preparedAuth) {
 	return preparedAuth?.kind === "profile" ? "subscription" : void 0;
 }
 async function resolveCodexAppServerClientStartContext(options) {
-	const agentDir = options?.agentDir ?? resolveDefaultAgentDir(options?.config ?? {});
-	const requestedStartOptions = options?.startOptions ?? resolveCodexAppServerRuntimeOptions().start;
+	const requestedStartOptions = options?.startOptions ?? resolveCodexAppServerRuntimeOptions({ pluginConfig: options?.pluginConfig }).start;
+	const agentDir = options?.agentDir ?? (requestedStartOptions.homeScope === "user" ? void 0 : resolveDefaultAgentDir(options?.config ?? {}));
 	const desktopGeneration = shouldTrackDesktopGeneration(requestedStartOptions, options?.pluginConfig) ? await waitForCodexDesktopGeneration() : void 0;
 	const preparedAuth = options?.preparedAuth;
 	const preparedApiKey = preparedAuth?.kind === "api-key" ? preparedAuth.apiKey.trim() : void 0;
@@ -2331,11 +2663,11 @@ async function withLeasedCodexAppServerClientStartSelectionRetry(params) {
 	let client = params.lease.client;
 	if (!client) throw new Error("Codex app-server selection retry requires an active client lease");
 	const timeoutMs = params.options?.timeoutMs ?? 6e4;
-	const deadline = Date.now() + timeoutMs;
+	const deadline = performance.now() + timeoutMs;
 	const signal = params.signal ?? params.options?.abandonSignal;
 	const requestOptions = () => {
 		if (signal?.aborted) throw new CodexAppServerStartupError("aborted", "Codex app-server selection retry aborted");
-		const remainingTimeoutMs = deadline - Date.now();
+		const remainingTimeoutMs = deadline - performance.now();
 		if (remainingTimeoutMs <= 0) throw new CodexAppServerStartupError("timed_out", "Codex app-server selection retry timed out");
 		return {
 			timeoutMs: remainingTimeoutMs,
@@ -2484,7 +2816,7 @@ function buildCodexAppServerInitializeTimeoutError(client) {
 }
 function resolveRemainingAcquireTimeout(timeoutMs, startedAt) {
 	if (!(timeoutMs > 0)) return timeoutMs;
-	const remaining = timeoutMs - (Date.now() - startedAt);
+	const remaining = timeoutMs - (performance.now() - startedAt);
 	if (remaining <= 0) throw new CodexAppServerStartupError("timed_out", "codex app-server initialize timed out");
 	return remaining;
 }
@@ -2564,7 +2896,7 @@ function trackIsolatedCodexAppServerClient(client) {
 	});
 }
 async function startInitializedCodexAppServerClient(params) {
-	const acquireStartedAt = Date.now();
+	const acquireStartedAt = performance.now();
 	const timeoutMs = params.timeoutMs ?? 0;
 	const abandonSignal = params.abandonSignal ? AbortSignal.any([params.lifetime.controller.signal, params.abandonSignal]) : params.lifetime.controller.signal;
 	const waitForStartup = (operation, timeoutMessage = CODEX_APP_SERVER_INITIALIZE_TIMEOUT_MESSAGE, timeoutErrorFactory) => {
@@ -2609,7 +2941,7 @@ async function startInitializedCodexAppServerClient(params) {
 		} finally {
 			artifactDrain?.cancel();
 		}
-		const runtimeArtifactModule = params.runtimeArtifactMode ? await import("./runtime-artifact-T-NwqeSH.js") : void 0;
+		const runtimeArtifactModule = params.runtimeArtifactMode ? await import("./runtime-artifact-Dy38Z5iU.mjs") : void 0;
 		const runtimeArtifactBeforeStart = runtimeArtifactModule ? await runtimeArtifactModule.captureCodexAppServerRuntimeArtifactBeforeStart({
 			startOptions,
 			spawnIdentity: resolveCodexAppServerSpawnIdentity(startOptions),
@@ -2651,6 +2983,10 @@ async function startInitializedCodexAppServerClient(params) {
 			}
 			assertStartupCurrent();
 			params.onInitializedClient?.();
+			await waitForStartup(() => observeCodexCatalogClient(client, {
+				startOptions: params.requestedStartOptions,
+				agentDir: params.agentDir
+			}));
 			let runtimeArtifact;
 			if (runtimeArtifactModule && runtimeArtifactBeforeStart) {
 				runtimeArtifact = await runtimeArtifactModule.finalizeCodexAppServerRuntimeArtifact({
@@ -2671,7 +3007,7 @@ async function startInitializedCodexAppServerClient(params) {
 				onAuthRefreshFailure: () => retireSharedCodexAppServerClientIfCurrent(client)
 			});
 			assertStartupCurrent();
-			await waitForStartup(() => applyCodexAppServerAuthProfile({
+			const authHandoff = await waitForStartup(() => applyCodexAppServerAuthProfile({
 				client,
 				agentDir: params.agentDir,
 				authProfileId: params.authProfileId,
@@ -2682,6 +3018,8 @@ async function startInitializedCodexAppServerClient(params) {
 				assertCurrent: assertStartupCurrent,
 				...params.authProfileStore ? { authProfileStore: params.authProfileStore } : {}
 			}));
+			if (startOptions.transport === "stdio" && nativeCommandAtStart && !desktopGeneration && !isManagedCodexDesktopCommand(startOptions.command) && !isCodexAppServerProxyLaunch(startOptions.args)) ownCodexInferenceClient(client);
+			recordCodexAppServerAuthHandoff(client, authHandoff);
 			if (runtimeArtifactModule && runtimeArtifact) runtimeArtifactModule.bindCodexAppServerRuntimeArtifact(client, runtimeArtifact);
 			assertStartupCurrent();
 			const fenceKey = resolveCodexNativeConfigFenceKey({ client });
@@ -2694,7 +3032,7 @@ async function startInitializedCodexAppServerClient(params) {
 					release();
 					throw error;
 				}
-			});
+			}, () => Boolean(retireSharedCodexAppServerClientIfCurrent(client)));
 			ready = true;
 			return client;
 		} finally {
@@ -2769,8 +3107,8 @@ function retainSharedCodexAppServerClientByInstanceId(clientId) {
 function captureCodexAppServerClientLifetime(client, requiredOwnership) {
 	const state = getSharedCodexAppServerClientState();
 	const start = state.startMetadata.get(client)?.startOptions;
-	if (requiredOwnership === "native-process" && (start?.transport !== "stdio" || isCodexAppServerProxyLaunch(start.args))) throw new AgentHarnessPreflightError("Codex ordinary configuration refresh requires an OpenClaw-managed local stdio process, not an external socket or app-server proxy. No turn was sent; reconnect through managed local stdio before continuing.");
-	const isCurrent = requiredOwnership === "native-process" && state.isolatedClients.has(client) ? () => state.isolatedClients.has(client) && !client.getCloseError() : captureSharedClientRegistration(client);
+	if (requiredOwnership === "native-process" && (start?.transport !== "stdio" || isCodexAppServerProxyLaunch(start.args))) throw new AgentHarnessPreflightError("Codex manual thread adoption requires an OpenClaw-managed local stdio process, not an external socket or app-server proxy. No turn was sent; reconnect through managed local stdio before continuing.");
+	const isCurrent = requiredOwnership !== "connection" && state.isolatedClients.has(client) ? () => state.isolatedClients.has(client) && !client.getCloseError() : captureSharedClientRegistration(client);
 	const assertCurrent = () => {
 		if (!isCurrent()) throw new CodexAdoptedThreadActiveError("Codex app-server connection changed during thread preparation; reconnect before continuing");
 		assertCodexAppServerClientStartSelectionCurrent({ client });
@@ -2846,6 +3184,7 @@ async function clearSharedCodexAppServerClientAndWait(options) {
 	try {
 		while (lifetime.pending.size > 0) await Promise.allSettled(lifetime.pending);
 		await closing;
+		await nativeHookRelayUnregisterQueue.flush();
 	} finally {
 		if (state.startup === lifetime) state.startup = createCodexAppServerStartupLifetime();
 	}
@@ -2908,4 +3247,4 @@ function retirePendingSharedClientEntryIfUnclaimed(entry) {
 	closeRetiredSharedClientEntry(entry);
 }
 //#endregion
-export { assertNotSymlink as $, resolveCodexGatewayTimeoutWithGraceMs as A, prepareCodexWorkspaceReferences as B, CodexThreadBindingConflictError as C, TURN_FINALIZE_DRAIN_ABORT_GRACE_MS as D, CodexAppServerStartupError as E, ensureCodexAppServerClientRuntime as F, unsubscribeCodexAppServerLiveThread as G, readCodexClientSessionMeta as H, forgetCodexWorkspaceReferences as I, rememberCodexRateLimitsRead as J, readCodexRateLimitsRevision as K, hasCodexAppServerLiveThread as L, withCodexStartupTimeout as M, claimCodexAppServerLiveThread as N, TURN_TERMINAL_SETTLEMENT_TIMEOUT_MS as O, consumeCodexAppServerLiveThread as P, resolveCodexManagedBundledMarketplacePath as Q, isCodexAppServerClientRuntimeLive as R, CodexAdoptedThreadActiveError as S, acquireCodexNativeConfigFence as T, releaseCodexAppServerLiveThread as U, protectCodexAppServerLiveThread as V, retainCodexAppServerLiveThread as W, resolveCodexAppServerAuthAccountCacheKey as X, reconcileCodexComputerUseStartArtifacts as Y, resolveCodexAppServerPreparedAuthHandoff as Z, retainSharedCodexAppServerClientByInstanceId as _, clearSharedCodexAppServerClientIfCurrentAndUnclaimed as a, waitForCodexAppServerClientDesktopGenerationDrain as b, getLeasedSharedCodexAppServerClient as c, readCodexAppServerClientDesktopGeneration as d, readCodexAppServerClientDesktopGenerationFingerprint as f, resolveCodexNativeConfigFenceKey as g, releaseLeasedSharedCodexAppServerClient as h, clearSharedCodexAppServerClientIfCurrent as i, resolveCodexStartupTimeoutMs as j, isCodexAppServerStartupError as k, getSharedCodexAppServerClient as l, releaseCodexAppServerClientLease as m, captureCodexAppServerClientLifetime as n, clearSharedCodexAppServerClientIfCurrentAndWait as o, readCodexAppServerClientProcessIdentity as p, readRecentCodexRateLimits as q, captureSharedCodexAppServerCatalogLifetime as r, createIsolatedCodexAppServerClient as s, assertCodexAppServerClientStartSelectionCurrent as t, isCodexAppServerStartSelectionChangedError as u, retainSharedCodexAppServerClientIfCurrent as v, CodexThreadStartRequestError as w, withLeasedCodexAppServerClientStartSelectionRetry as x, shared_client_exports as y, isCodexAppServerLiveThreadClaimed as z };
+export { assertNotSymlink as $, getCodexInferenceThread as A, prepareCodexWorkspaceReferences as B, CodexThreadBindingConflictError as C, acquireCodexNativeConfigFence as D, nativeHookRelayUnregisterQueue as E, forgetCodexWorkspaceReferences as F, unsubscribeCodexAppServerLiveThread as G, readCodexClientSessionMeta as H, hasCodexAppServerLiveThread as I, rememberCodexRateLimitsRead as J, readCodexRateLimitsRevision as K, hasCodexAppServerSiblingThreadWork as L, claimCodexAppServerLiveThread as M, consumeCodexAppServerLiveThread as N, assertCodexInferenceRouteConfig as O, ensureCodexAppServerClientRuntime as P, resolveCodexManagedBundledMarketplacePath as Q, isCodexAppServerClientRuntimeLive as R, CodexAdoptedThreadActiveError as S, CodexThreadStartRequestError as T, releaseCodexAppServerLiveThread as U, protectCodexAppServerLiveThread as V, retainCodexAppServerLiveThread as W, resolveCodexAppServerAuthAccountCacheKey as X, reconcileCodexComputerUseStartArtifacts as Y, resolveCodexAppServerPreparedAuthHandoff as Z, retainSharedCodexAppServerClientByInstanceId as _, clearSharedCodexAppServerClientIfCurrentAndUnclaimed as a, resolveCodexStartupTimeoutMs as at, waitForCodexAppServerClientDesktopGenerationDrain as b, getLeasedSharedCodexAppServerClient as c, readCodexAppServerClientDesktopGeneration as d, CodexAppServerStartupError as et, readCodexAppServerClientDesktopGenerationFingerprint as f, resolveCodexNativeConfigFenceKey as g, releaseLeasedSharedCodexAppServerClient as h, clearSharedCodexAppServerClientIfCurrent as i, resolveCodexGatewayTimeoutWithGraceMs as it, prepareCodexInferenceThreadConfig as j, bindCodexInferenceThread as k, getSharedCodexAppServerClient as l, releaseCodexAppServerClientLease as m, captureCodexAppServerClientLifetime as n, TURN_TERMINAL_SETTLEMENT_TIMEOUT_MS as nt, clearSharedCodexAppServerClientIfCurrentAndWait as o, withCodexStartupTimeout as ot, readCodexAppServerClientProcessIdentity as p, readRecentCodexRateLimits as q, captureSharedCodexAppServerCatalogLifetime as r, isCodexAppServerStartupError as rt, createIsolatedCodexAppServerClient as s, assertCodexAppServerClientStartSelectionCurrent as t, TURN_FINALIZE_DRAIN_ABORT_GRACE_MS as tt, isCodexAppServerStartSelectionChangedError as u, retainSharedCodexAppServerClientIfCurrent as v, CodexThreadClientReplacementError as w, withLeasedCodexAppServerClientStartSelectionRetry as x, shared_client_exports as y, isCodexAppServerLiveThreadClaimed as z };